PT-2009-1240 · Dj Bernstein · Djbdns

Publicado 2009-02-19 · Atualizado 2017-08-08 · CVE-2008-4392

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions djbdns version 1.05

Description The issue allows remote attackers to spoof DNS responses more easily due to the lack of prevention of simultaneous identical outbound DNS queries. This can be demonstrated by a spoofed A record in the Additional section of a response to a Start of Authority (SOA) query.

Recommendations For djbdns version 1.05, consider implementing a mechanism to prevent simultaneous identical outbound DNS queries as a mitigation measure until a patch is available.

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2008-4392

Produtos afetados

Djbdns

Referências · 13

• https://osv.dev/vulnerability/UBUNTU-CVE-2008-4392 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-4392 · Nota de Segurança
• http://secunia.com/advisories/33855 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2008-4392 · Aviso do Fabricante
• http://cr.yp.to/djbdns/forgery.html · Nota
• http://your.org/dnscache/djbdns.pdf · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48807 · Nota
• https://security-tracker.debian.org/tracker/CVE-2008-4392 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2008-4392 · Aviso do Fabricante
• http://your.org/dnscache · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-4392 · Aviso do Fabricante
• http://securityfocus.com/bid/33818 · Nota
• https://cve.org/CVERecord?id=CVE-2008-4392 · Nota de Segurança